Skip to content

Commit d0557ad

Browse files
jboerojboero
authored
Merge pull request hashicorp#313 from hashicorp/panos-srgs
add restrict-panos-srgs policy
2 parents 8087e03 + b58bb3c commit d0557ad

File tree

7 files changed

+425
-1
lines changed

7 files changed

+425
-1
lines changed

‎governance/third-generation/cloud-agnostic/restrict-panos-srgs.sentinel

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# This policy uses the Sentinel tfplan/v2 import to restrict the
2+
# destination addresses of Palo Alto Networks security rule groups
3+
# to not have "any".
4+
5+
# Import common-functions/tfplan-functions/tfplan-functions.sentinel
6+
# with alias "plan"
7+
import "tfplan-functions" as plan
8+
9+
# Get all Security Rule Groups
10+
allSRGs = plan.find_resources("panos_security_rule_group")
11+
12+
# Validate Security Rule Groups
13+
violatingSRGsCount = 0
14+
for allSRGs as address, srg {
15+
16+
# Find the rules of the current SRG
17+
rules = plan.find_blocks(srg, "rule")
18+
19+
# Filter to violating rules that contain "any" in destination_addresses
20+
# Warnings will not be printed for violations since the last parameter is false
21+
violatingRules = plan.filter_attribute_contains_items_from_list(rules,
22+
"destination_addresses", ["any"], false)
23+
24+
# Print violation messages
25+
if length(violatingRules["messages"]) > 0 {
26+
violatingSRGsCount += 1
27+
print("SRG Rule Violation:", address, "has at least one rule",
28+
"with destination_addresses containing \"any\".")
29+
plan.print_violations(violatingRules["messages"], "Rule")
30+
} // end if
31+
32+
} // end for SRGs
33+
34+
# Main rule
35+
main = rule {
36+
violatingSRGsCount is 0
37+
}

‎governance/third-generation/cloud-agnostic/sentinel.hcl

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,11 @@ policy "restrict-databricks-clusters" {
104104
enforcement_level = "advisory"
105105
}
106106

107+
policy "restrict-panos-srgs" {
108+
source = "./restrict-panos-srgs.sentinel"
109+
enforcement_level = "advisory"
110+
}
111+
107112
policy "restrict-remote-state" {
108113
source = "./restrict-remote-state.sentinel"
109114
enforcement_level = "advisory"

‎governance/third-generation/cloud-agnostic/test/restrict-panos-srgs/fail.hcl

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
module "tfplan-functions" {
2+
source = "../../../common-functions/tfplan-functions/tfplan-functions.sentinel"
3+
}
4+
5+
mock "tfplan/v2" {
6+
module {
7+
source = "mock-tfplan-fail.sentinel"
8+
}
9+
}
10+
11+
test {
12+
rules = {
13+
main = false
14+
}
15+
}

‎governance/third-generation/cloud-agnostic/test/restrict-panos-srgs/mock-tfplan-fail.sentinel

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
terraform_version = "1.0.10"
2+
3+
variables = {}
4+
5+
resource_changes = {
6+
"panos_security_rule_group.devtodmz": {
7+
"address": "panos_security_rule_group.devtodmz",
8+
"change": {
9+
"actions": [
10+
"create",
11+
],
12+
"after": {
13+
"position_keyword": null,
14+
"position_reference": null,
15+
"rule": [
16+
{
17+
"action": "allow",
18+
"applications": [
19+
"any",
20+
],
21+
"categories": [
22+
"any",
23+
],
24+
"data_filtering": null,
25+
"description": "test",
26+
"destination_addresses": [
27+
"any",
28+
],
29+
"destination_zones": [
30+
"dmz",
31+
],
32+
"disable_server_response_inspection": null,
33+
"disabled": null,
34+
"file_blocking": null,
35+
"group": null,
36+
"hip_profiles": [
37+
"any",
38+
],
39+
"icmp_unreachable": null,
40+
"log_end": true,
41+
"log_setting": null,
42+
"log_start": null,
43+
"name": "allow dev to dmz",
44+
"negate_destination": null,
45+
"negate_source": null,
46+
"schedule": null,
47+
"services": [
48+
"application-default",
49+
],
50+
"source_addresses": [
51+
"10.1.1.0/24",
52+
],
53+
"source_users": [
54+
"any",
55+
],
56+
"source_zones": [
57+
"dev",
58+
],
59+
"spyware": null,
60+
"tags": null,
61+
"type": "universal",
62+
"url_filtering": null,
63+
"virus": null,
64+
"vulnerability": null,
65+
"wildfire_analysis": null,
66+
},
67+
],
68+
"vsys": "vsys1",
69+
},
70+
"after_unknown": {
71+
"id": true,
72+
"rule": [
73+
{
74+
"applications": [
75+
false,
76+
],
77+
"categories": [
78+
false,
79+
],
80+
"destination_addresses": [
81+
false,
82+
],
83+
"destination_zones": [
84+
false,
85+
],
86+
"hip_profiles": [
87+
false,
88+
],
89+
"services": [
90+
false,
91+
],
92+
"source_addresses": [
93+
false,
94+
],
95+
"source_users": [
96+
false,
97+
],
98+
"source_zones": [
99+
false,
100+
],
101+
},
102+
],
103+
},
104+
"before": null,
105+
},
106+
"deposed": "",
107+
"index": null,
108+
"mode": "managed",
109+
"module_address": "",
110+
"name": "devtodmz",
111+
"provider_name": "registry.terraform.io/paloaltonetworks/panos",
112+
"type": "panos_security_rule_group",
113+
},
114+
"panos_zone.dev": {
115+
"address": "panos_zone.dev",
116+
"change": {
117+
"actions": [
118+
"create",
119+
],
120+
"after": {
121+
"enable_user_id": false,
122+
"exclude_acls": null,
123+
"include_acls": null,
124+
"log_setting": null,
125+
"mode": "layer3",
126+
"name": "dev",
127+
"vsys": "vsys1",
128+
"zone_profile": null,
129+
},
130+
"after_unknown": {
131+
"id": true,
132+
"interfaces": true,
133+
},
134+
"before": null,
135+
},
136+
"deposed": "",
137+
"index": null,
138+
"mode": "managed",
139+
"module_address": "",
140+
"name": "dev",
141+
"provider_name": "registry.terraform.io/paloaltonetworks/panos",
142+
"type": "panos_zone",
143+
},
144+
"panos_zone.dmz": {
145+
"address": "panos_zone.dmz",
146+
"change": {
147+
"actions": [
148+
"create",
149+
],
150+
"after": {
151+
"enable_user_id": false,
152+
"exclude_acls": null,
153+
"include_acls": null,
154+
"log_setting": null,
155+
"mode": "layer3",
156+
"name": "dmz",
157+
"vsys": "vsys1",
158+
"zone_profile": null,
159+
},
160+
"after_unknown": {
161+
"id": true,
162+
"interfaces": true,
163+
},
164+
"before": null,
165+
},
166+
"deposed": "",
167+
"index": null,
168+
"mode": "managed",
169+
"module_address": "",
170+
"name": "dmz",
171+
"provider_name": "registry.terraform.io/paloaltonetworks/panos",
172+
"type": "panos_zone",
173+
},
174+
}
175+
176+
output_changes = {}

0 commit comments

Comments
 (0)